M6 (cipher)

Infobox block cipher
name = M6
designers = Hitachi
publish date = 1997
derived from =
derived to = M8
related to =
key size = 40-64 bits
block size = 64 bits
structure = Feistel network
rounds = 10
cryptanalysis = Mod n cryptanalysis: 1 known plaintext allows to recover the key with about 2³⁵ trial encryptions; "a few dozen" known plaintexts reduces this to about 2³¹In cryptography, M6 is a block cipher proposed by Hitachi in 1997 for use in the IEEE 1394 FireWire standard. The design allows some freedom in choosing a few of the cipher's operations, so M6 is considered a family of ciphers.

The algorithm operates on blocks of 64 bits using a 10-round Feistel networkstructure. The key size is 40 bits by default, but can be up to 64 bits. The key schedule is very simple, producing two 32-bit subkeys: the high 32 bits of the key, and the sum mod 2³² of this and the low 32 bits.

Because its round function is based on rotation and addition, M6 was one of the first ciphersattacked by mod n cryptanalysis. Mod 5, about 100 known plaintexts suffice to distinguish the output from a pseudorandom permutation. Mod 257, information about the secret key itself is revealed. One known plaintext reduces the complexity of a brute force attack to about 2³⁵ trial encryptions; "a few dozen" known plaintexts lowers this number to about 2³¹. Due to its simple key schedule, M6 is also vulnerable to a slide attack, which requires more known plaintext but less computation.

References

* cite conference
author = John Kelsey, Bruce Schneier, David Wagner
title = Mod n Cryptanalysis, with Applications Against RC5P and M6
booktitle = 6th International Workshop on Fast Software Encryption (FSE '99)
pages = pp.139–155
publisher = Springer-Verlag
date = March 1999
location = Rome
url = http://www.schneier.com/paper-mod3.html
format = PDF/PostScript
accessdate = 2007-01-25
* cite paper
author = David Wagner, Alex Biryukov
title = Slide Attacks
date = 1999
url = http://www.cs.berkeley.edu/~daw/papers/slide-fse99-pre.ps
format = PostScript
accessdate = 2007-01-25